Supermicro spy chips, the sequel: It happened, and with bad BIOS | Hacker News Reader

Supermicro spy chips, the sequel: It happened, and with bad BIOS

theregister.com

15 pointsbased24 comments

A targeted bad BIOS update is more plausible than a special chip hidden between layers of the motherboard. especially with the management BMC IPMI which is basically a second OS that acts as a KVM switch. But if this is all it is, this whole investigative thing is overblown to say the least. But why?

https://trmm.net/Modchips/

This presentation at 35C3 made me a believe that the original Bloomberg report is grounded in truth

I need to see to believe this. Thanks for this great article points out how it’s technically possible; but it would be dead simple to prove with a sample! Pray show one SMC MB with this extra chip and you are golden, if it’d a supply chain attack it was mass produced and a compromised unit is bound to show up on ebay!?

otherwise could this be a market manipulation attempt?

Last time around SMC stock lost half of its value overnight. Have you ever read how bberg remunerates reporters?

How would you show them if a) they are rare b) all known instances are in the hands of DoD/FBI c) DoD/FBI are not interested at all in publishing any information about it. Are you sure it's as simple as

> it was mass produced

I don't think Bloomberg claimed it (compromised MBs) were mass-produced to the tune that every random ebay board contained it. In the parallel case of NSA, compromised hardware was pretty rare and created on case-by-case basis. It could be produced based on shipment batch, knowing (e.g. by hacking a shipping system database) the specific batch goes to a specific sensitive client.

> otherwise could this be a market manipulation attempt?

Pretty elaborate attempt, especially given such thing as appearance of massive shorts on SMC stocks immediately preceding the publication would be very visible (and prosecutable). I'm sure one can insider-trade easier than spending 3 years on massive research involving interviews with dozens of people.

Reply on news.ycombinator.com